Moquette versions before 0.18.1 have an incorrect authorization flaw (CWE-863) in the AuthorizationsCollector.canDoOperation method. When pattern-based ACL rules include placeholders %c or %u, client ID and username values are substituted directly into MQTT topic filters. If these values contain MQTT wildcard characters (+ or #), the resulting filter can be broadened, enabling clients to access topics across tenant boundaries, violating authorization constraints. The use of # can also cause a NullPointerException in Topic.match, disrupting session processing. This vulnerability is addressed in moquette version 0.18.1.

Exploitation allows a client to bypass authorization controls and gain unauthorized read and write access to MQTT topics belonging to other tenants. This compromises confidentiality and integrity of data across tenant boundaries. Additionally, malformed filters can cause service disruption by triggering exceptions during session processing. The CVSS 3.1 score is 9.6 (critical), reflecting network attack vector, low complexity, low privileges required, no user interaction, scope change, and high confidentiality and integrity impact.

Upgrade moquette to version 0.18.1 or later, where this authorization issue is fixed. No other mitigation is indicated or required by the vendor advisory. Patch status is confirmed fixed in 0.18.1.